The vulnerability is an Argument Injection flaw in the CloudPagesUrl module of Salesforce Marketing Cloud Engagement. It permits an attacker to inject malicious command‑line arguments into the web service protocol, potentially leading to arbitrary command execution and compromise of data confidentiality, integrity, or availability. The flaw stems from improper neutralization of argument delimiters, a classic injection weakness.

Salesforce Marketing Cloud Engagement is impacted, specifically any installation using the CloudPagesUrl module prior to January 21, 2026. No narrower version information is disclosed.

This flaw carries a CVSS v3.1 score of 9.8, indicating critical severity. The EPSS score is below 1%, suggesting that, in practice, exploitation is unlikely to be widespread at this time, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog. Attackers would need remote access to the service endpoints and the ability to submit crafted requests; the likely vector is a remote HTTP(S) request to the affected web service.